agency-lang@0.34.0
The Agency language
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source configures the bundled agent to send observability events to a hosted endpoint when STATELOG_API_KEY is available, and those events can include branch values. This is undisclosed runtime telemetry that may carry user or project data, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running the bundled agent when STATELOG_API_KEY is set.
Impact
Agent output and related user or project data may leave the machine without clear disclosure or a visible opt-out in this configuration.
Mechanism
Observability is enabled in the agent configuration; the Statelog client posts event data to /api/logs using the configured key.
AI rationale
The source configures the bundled agent to send observability events to a hosted endpoint when STATELOG_API_KEY is available, and those events can include branch values. This is undisclosed runtime telemetry that may carry user or project data, so it warrants a warning.
Evidence
dist/lib/agents/agency-agent/lib/outputCap.jsdist/lib/statelogClient.jslog.jsonl
Network endpoints1
statelog.adit.io/api/logs
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled agent enables observability and configures statelog.adit.io with STATELOG_API_KEY.
- Statelog events include fork branch values, which can contain agent output or user/project data.
- When a Statelog API key is present, the client posts its event body to the configured host.
Evidence against
- Remote logging requires STATELOG_API_KEY to be present.
- The flagged skills and LSP configuration writes are invoked through explicit CLI commands.
- The ffmpeg subprocess is used for media transcoding and writes a temporary output file that is removed afterward.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggeddist/lib/optimize/optimizerModule.jsView file
32// eslint-disable-next-line no-restricted-syntax -- CLI-layer loading of a user artifact; the bundle path is only known at runtime
L33: const mod = await import(pathToFileURL(out).href);
L34: const factory = mod.default;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib/optimize/optimizerModule.jsView on unpkg · L32dist/lib/cli/schedule/backends/launchd.jsView file
1import { execFileSync } from "child_process";
L2: import * as fs from "fs";
...
L6: import renderPlist from "../../../templates/cli/schedule/plist.js";
L7: const PLIST_DIR = path.join(os.homedir(), "Library", "LaunchAgents");
L8: function plistPath(name) {
...
L64: agentDir: path.dirname(entry.agentFile),
L65: path: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
L66: home: os.homedir(),
...
L71: fs.mkdirSync(PLIST_DIR, { recursive: true });
L72: // Unload first if already loaded (launchctl load fails on already-loaded plists)
L73: if (fs.existsSync(dest)) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/cli/schedule/backends/launchd.jsFindings
4 High6 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/lib/stdlib/ffmpeg.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/cli/skills.js
HighSemantic Analysis Limiteddist/lib/cli/attach.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/lib/host/node/nodeSubprocess.js
MediumDynamic Requiredist/lib/optimize/optimizerModule.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/cli/schedule/backends/launchd.js
MediumShips Build Helperdist/lib/cli/mlxSpeechServer.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to agency-lang@0.34.0.
See all versions of agency-lang for other recorded verdicts.
- Review the evidence and your use of agency-lang@0.34.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.